lightningd: fix type of splice_depth_cb, remove never-working splice_inflight_txwatch.
What the developer wrote
Authored by Rusty Russell
lightningd: fix type of splice_depth_cb, remove never-working splice_inflight_txwatch.
We use typesafe callbacks: void * arguments are strongly eschewed.
Indeed, when we fix this one, we find it's getting called wrong in
splice_inflight_txwatch.
Since we handed the wrong arg to splice_inflight_txwatch (channel
instead of inflight), it never worked. Indeed, we always get:
Splice inflight event but not in AWAITING_SPLICE, ending watch of txid f6f0cb65584389caf7722b06d9ffe98aea3ad8fd04d74b2b11e2e227cf28cffe
So remove it. The watch will delete itself (as above), or be freed with the inflight.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit fixes a type mismatch in a Core Lightning function that watches for splice transactions reaching enough confirmations. The function was accidentally being passed a channel object instead of an inflight object, so the watcher never worked correctly and was effectively dead code. The fix removes the broken watcher entirely. There is no direct evidence this is exploitable for theft or denial of service, but it does clean up a real bug in how splice transactions are monitored.
Treat as a code-quality and defensive-hardening fix. Review whether the removed watcher was intended to provide any security-critical cleanup (e.g., preventing stale watches from firing after splice lock-in) and confirm that the remaining watch lifecycle is sufficient. No urgent security patch appears required, but include in normal release notes as a splice robustness improvement.
Security signals we found
Type confusion / argument mismatch in callback registration
Dead code removal for a never-working transaction watcher
Splice protocol code path affected
Defensive typesafe-callback enforcement
No explicit security claim in commit message
Evidence from the diff
The commit corrects the signature of splice_depth_cb from taking a void param to taking struct channel_inflight inflight, matching the typesafe callback pattern used elsewhere. It then removes splice_inflight_txwatch and its call site in handle_peer_splice_locked. That helper was passing struct channel channel to find_txwatch as the callback argument, while the callback expected struct channel_inflight inflight, so the lookup never matched a live watcher and the returned txwatch was always NULL. The log message ‘Splice inflight event but not in AWAITING_SPLICE, ending watch of txid …’ confirms the watcher was self-destructing rather than being intentionally unwatched. The change is defensive cleanup of a latent bug in the splice lifecycle code.
Changed components
lightningd/channel_control.csplice_depth_cb callbackwatch_splice_inflighthandle_peer_splice_lockedInspect captured patch +1 / −18
diff --git a/lightningd/channel_control.c b/lightningd/channel_control.c
index 9e1ab492..f03d224c 100644
--- a/lightningd/channel_control.c
+++ b/lightningd/channel_control.c
@@ -690,10 +690,9 @@ static enum watch_result splice_depth_cb(struct lightningd *ld,
const struct bitcoin_txid *txid,
const struct bitcoin_tx *tx,
unsigned int depth,
- void *param)
+ struct channel_inflight *inflight)
{
/* find_txwatch triggers a type warning on inflight, so we do this. */
- struct channel_inflight *inflight = param;
struct txlocator *loc;
struct short_channel_id scid;
@@ -750,14 +749,6 @@ void watch_splice_inflight(struct lightningd *ld,
splice_depth_cb, inflight);
}
-static struct txwatch *splice_inflight_txwatch(struct channel *channel,
- struct channel_inflight *inflight)
-{
- return find_txwatch(channel->peer->ld->topology,
- &inflight->funding->outpoint.txid,
- splice_depth_cb, channel);
-}
-
static void handle_splice_sending_sigs(struct lightningd *ld,
struct channel *channel,
const u8 *msg)
@@ -1151,7 +1142,6 @@ static void handle_peer_splice_locked(struct channel *channel, const u8 *msg)
s64 splice_amnt;
struct channel_inflight *inflight;
struct bitcoin_txid locked_txid;
- struct txwatch *txw;
if (!fromwire_channeld_got_splice_locked(msg, &funding_sats,
&splice_amnt,
@@ -1221,13 +1211,6 @@ static void handle_peer_splice_locked(struct channel *channel, const u8 *msg)
list_add_tail(&channel->inflights, &inflight->list);
lockin_complete(channel, CHANNELD_AWAITING_SPLICE);
-
- /* Turn off tx watcher for the splice */
- txw = splice_inflight_txwatch(channel, inflight);
- if (!txw)
- log_unusual(channel->log, "Can't unwatch txid %s",
- fmt_bitcoin_txid(tmpctx, &locked_txid));
- tal_free(txw);
}
/* We were informed by channeld that channel is ready (reached mindepth) */
Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.